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A spambot has leaked more than 700 million email addresses and passwords publicly in a huge data 
breach. 

The data dump occurred thanks to a misconfigured spambot, dubbed ‘Onliner’, and was discovered 
by a Paris-based security researcher known as Benkow. 
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Troy Hunt, an Australian computer security expert, who runs the breach website, Have I Been 
Pwned (HIBP), said in a blo g post “the one I’m writing about today is 711m records, which makes it 
the largest single set of data I’ve ever loaded into HIBP.” 

The scale and size is hard to comprehend but Hunt summed it up nicely, “that’s almost one address 
for every single man, woman and child in all of Europe”, he wrote. 

The data were accessible due to an open and accessible web server used by spammers, and was 
hosted in the Netherlands. The web server stored a huge collection of email addresses and 
passwords that were used to send spam after breaking into the users’ accounts and sending emails 
from those accounts. 

While the sheer number of leaked addresses and passwords is mind-boggling, there is some reason 
to be optimistic, as the actual number of real humans’ contact details contained in the dump will likely 
be reduced due to the number of fake and repeated email addresses contained in the data. 

“The data in the dump has a bunch of junk prefixed to the address, junk which appears to be a HTML 
file name and may indicate the ‘address’ was scraped off the web and the parsing simply wasn’t 
done very well”, Hunt said. “The point here is that there’s going to be a bunch of addresses here that 
simply aren’t very well-formed so whilst the 711 million’ headline is technically accurate, the number 
of real humans in the data is going to be somewhat less”. 

Indeed, the leaked email addresses have strong connections to the 164 million emails that were 
stolen from Linkedln in May 2016. After running a random selection of different email addresses, 
Hunt found that “every single one of them” appeared in that data breach just over a year ago. 
PoHtbwr of email addresses tested, mirrored the 4.2 million stolen from Exploit.ln. 
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